diff --git a/.github/workflows/bridge-release.yml b/.github/workflows/bridge-release.yml
index e04dffd..a67e671 100644
--- a/.github/workflows/bridge-release.yml
+++ b/.github/workflows/bridge-release.yml
@@ -106,7 +106,7 @@ jobs:
           cache-dependency-path: bridge/go.sum
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da  # pin v3.7.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # pin v4.1.2
         with:
           cosign-release: 'v2.5.0'
 
diff --git a/.github/workflows/cli-docker.yml b/.github/workflows/cli-docker.yml
index 71c2fb6..26495fd 100644
--- a/.github/workflows/cli-docker.yml
+++ b/.github/workflows/cli-docker.yml
@@ -198,7 +198,7 @@ jobs:
             SOURCE_DATE_EPOCH=${{ steps.vars.outputs.source_date_epoch }}
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da  # pin v3.7.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # pin v4.1.2
         with:
           cosign-release: 'v2.5.0'
 
diff --git a/.github/workflows/cli-release.yml b/.github/workflows/cli-release.yml
index aa040ba..bd6b29e 100644
--- a/.github/workflows/cli-release.yml
+++ b/.github/workflows/cli-release.yml
@@ -172,7 +172,7 @@ jobs:
           cache-dependency-path: cli/go.sum
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da  # pin v3.7.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # pin v4.1.2
         with:
           cosign-release: 'v2.5.0'